Executive brief
Netty, a popular networking framework for Java applications, is vulnerable to a denial-of-service attack. An attacker can send specific HTTP/2 configuration settings that cause the server to crash or become unresponsive while processing responses. This can lead to service outages and impact the availability of web applications and proxy services using the affected library.
Technical details
A vulnerability exists in Netty's handling of the HTTP/2 SETTINGS_MAX_HEADER_LIST_SIZE setting. When a client sends this advisory setting, Netty incorrectly attempts to honor it during response generation rather than treating it as advisory. This leads to an exception being thrown while writing response headers after the request has already been proxied to the origin. An attacker can exploit this to trigger resource exhaustion or service instability, similar to the HTTP/2 Rapid Reset attack but with a different on-the-wire signature. The issue is fixed in versions 4.1.135.Final and 4.2.15.Final by ignoring the client-provided setting.
Affected products
- Netty netty-codec-http2 >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final
Timeline
- 2026-06-08: disclosed
- 2026-06-12: advisory: NVD publication date
- 2026-06-15: patched: GitHub Advisory reviewed and updated